Method for managing access rights to memory regions and corresponding system-on-chip

Abstract

The method for managing access rights to memory regions (R1, R2) of a memory (MEM) includes assigning an execute permission status (E, NE) to each memory region in a dedicated memory firewall (FWL), such that the contents of a memory region with an executable status (E) are eligible to be executed by a processor (CPU), and the contents of a memory region with a non-executable status (NE) are not eligible to be executed by the processor (CPU). Figure 1 for the abstract

Description

Title of the invention: Method for managing access rights to memory regions and corresponding system on chip

[0001] Embodiments and implementations relate to the management of access rights of memory regions, in particular in a system on chip.

[0002] Typically, during the boot procedure of systems on chips, the various boot firmwares are authenticated, and possibly decrypted, for the next firmware step using a signature mechanism. This allows a reliable boot chain to be created.

[0003] Each boot firmware has the ability to program a memory management and protection unit, typically a memory protection unit "MPU" (acronyms for the common English terms "Memory Protection Unit") or a memory management unit "MMU" (acronyms for the common English terms "Memory Management Unit"), to define which parts of the memory are executable and which are not.

[0004] But typically, the memory management and protection unit can be disabled before jumping into the next firmware that will reconfigure it according to its needs. Disabling the memory management and protection unit can occur in the classic case of a reset (usually a reboot) of the processor in the boot phase, which also resets the parameters of the memory management and protection unit.

[0005] In the event of fault injection at this time, it is possible to generate a shift (usually a "glitch" in English) on the program counter (usually "PC" for "program counter" in English) pointing to the memory address of an instruction to be executed, and thus to jump to a memory address containing an unauthenticated instruction or one that is not supposed to be executed.

[0006] To minimize this risk, conventional solutions propose authenticating the complete image of the content loaded into the memory, guaranteeing the content of the memory, for example, by erasing all unused regions to avoid defective code, keeping the memory management and protection unit active during reset, or even providing a non-volatile memory region specifically executable for startup.

[0007] These conventional solutions present difficulties insofar as they degrade the performance of the system on chip, or generate complex mechanisms which depend on processor and memory management and protection unit capabilities, and may not be compatible with all firmware.

[0008] Thus, there is a need to remedy these drawbacks.

[0009] Implementations and embodiments propose adding a new status in a memory firewall to define an execution permission for the different memory regions, i.e. an executable or non-executable status, in a manner comparable to the read permission and write permission statuses of the memory regions in conventional firewalls.

[0010] Thus, according to one aspect, a method is proposed for managing access rights to memory regions of a memory, for example a volatile memory "RAM" (acronym for the usual English terms "random access memory"), comprising an allocation of an execution permission status for each memory region in a firewall device dedicated to the memory, such that the content of a memory region having an executable status is capable of being executed by a processor, and the content of a memory region having a non-executable status cannot be executed by the processor.

[0011] Consequently, in the event of a fault injection attack and generation of a "glitch" on the program counter, it will not be possible to execute data or code contained outside the authenticated memory regions. In addition, this makes it possible to implement a software countermeasure since the processor's program counter remains inside the authenticated code.

[0012] According to one embodiment, the assignment of the execution permission status comprises an assignment of the non-executable status to the memory regions containing data.

[0013] Indeed, the data contained in memory can be read or written, but are never intended to be executed like a program code recorded in binary in the memory. This embodiment thus makes it possible to systematically prevent the erroneous execution of data.

[0014] According to one embodiment, the assignment of the execution permission status comprises a phase of verifying the authenticity of the content of the memory regions containing program code, an assignment of the executable status to the memory regions whose content is authenticated in the verification phase, and an assignment of the non-executable status to the memory regions whose content is not authenticated in the verification phase.

[0015] The authenticity verification phase may include an implementation of a hash function and possibly a decryption of the contents of the memory regions.

[0016] According to one embodiment, an execution by the processor of the content of a first memory region comprises a second phase of verifying the authenticity of the content of a second memory region, the method comprising assigning the executable status to the second memory region if the content of the second memory region is authenticated in the second verification phase, and assigning the non-executable status to the second memory region if the content of the second memory region is not authenticated in the second verification phase.

[0017] Thus, the second memory region can be authenticated a second time during the execution of the contents of the first memory region. The execution of the contents of the first region can in fact make it possible to obtain additional authentication information to verify the authenticity of the second memory region. This is for example the case when the second memory region contains an extension, owned by a user, the authentication of which cannot be carried out by the system-on-chip in its initial configuration at startup.

[0018] According to one embodiment, the execution permission status is assigned to each memory region in the firewall device in addition to a read permission status and a write permission status.

[0019] According to one embodiment, the memory regions having the non-executable execution permission status may have the read-permitted or read-unpermitted status as well as the write-permitted or write-unpermitted status.

[0020] Indeed, unlike conventional techniques where the execution of the contents of a memory region is prevented by setting the read permission status of this region to "non-readable", the use of the execution permission status allows read access to a non-executable memory region. This makes it possible in particular to verify in read its authenticity or the nature of its contents (for example binary code or data), without creating a flaw in terms of execution, for example in the event of fault injection as mentioned above.

[0021] According to one embodiment, said assignment of an execution permission status comprises, for each memory region, an assignment of different respective execution permission statuses to different processors, in the firewall device.

[0022] According to another aspect, there is provided a system-on-chip comprising a processor, a memory having memory regions, and a firewall device dedicated to the memory, in which an access rights management means is configured to assign an execution permission status for each memory region in the firewall device, the firewall device and the processor being configured such that the contents of a memory region having an executable status are suitable for being executed by the processor, and the contents of a memory region having a non- executable cannot be executed by the processor.

[0023] According to one embodiment, the access rights management means is configured to assign non-executable status to memory regions containing data.

[0024] According to one embodiment, the access rights management means is configured to verify the authenticity of the content of memory regions containing program code, to assign executable status to memory regions whose content is authenticated and to assign non-executable status to memory regions whose content is not authenticated.

[0025] According to one embodiment, the access rights management means, during an execution of the content of a first memory region by the processor, is configured to secondly verify the authenticity of the content of a second memory region, and to assign the executable status to the second memory region if the content of the second memory region is secondly authenticated, and to assign the non-executable status to the second memory region if the content of the second memory region is not secondly authenticated.

[0026] According to one embodiment, the access rights management means is configured to assign the execution permission status to each memory region in the firewall device in addition to a read permission status and a write permission status.

[0027] According to one embodiment, the access rights management means is configured to assign the read-permitted or read-unpermitted status as well as the write-permitted or write-unpermitted status, to the memory regions having the non-executable execution permission status.

[0028] According to one embodiment, the system-on-chip further comprises at least one other processor, and the access rights management means is configured to assign, for each memory region, different respective execution permission statuses to the different processors, in the firewall device.

[0029] Other advantages and characteristics of the invention will appear on examining the detailed description of modes of implementation and embodiment, which are in no way limiting, and the appended drawings, in which:

[0030] [Fig.l] ;

[0031] [Fig.2] ;

[0032] [Fig.3] ;

[0033] [Fig.4] illustrate embodiments and methods of implementing the invention.

[0034] [Fig.l] illustrates an exemplary embodiment of a system on chip SOC, comprising in particular a CPU processor, a memory MEM of the random access memory or “RAM” type, and a FWL firewall device dedicated to the memory MEM.

[0035] The different elements of the system on chip SOC are interconnected by a bus of integrated BUS system, for example of the “AXI” type (acronym for the common English term “Advanced extensible Interface”).

[0036] The CPU processor is advantageously provided with a memory management and protection unit MMU / MPU. Typically, depending on the type and performance of the CPU processor, the memory management and protection unit MMU / MPU may be a memory protection unit "MPU" (acronyms for the common English terms "Memory Protection Unit") or a memory management unit "MMU" (acronyms for the common English terms "Memory Management Unit"). The memory management and protection unit MMU / MPU typically makes it possible to control the accesses that the CPU processor makes to the memory MEM, and in particular according to an access rights context in which the CPU processor is located, with respect to the memory regions RI, R2 of the memory MEM.

[0037] The FWL firewall device is dedicated to the MEM memory, and makes it possible to control the accesses which are made to the memory, coming from the CPU processor, or from a possible other master device connected to the bus BUS. The FWL firewall is configured to check the access right level of a request for access to the MEM memory, compared to the access right level required to access the corresponding memory region RI, R2, and to authorize or not the access.

[0038] In other words, the memory management and protection unit MMU / MPU provides protection related to the state of the CPU processor, while the firewall FWL provides protection related to the content of the memory regions RI, R2.

[0039] Furthermore, the system on chip SOC may include an internal non-volatile memory (usually “Read Only Memory” in English) containing elementary ROMcode program code for starting the system on chip SOC, and also benefit from an external mass storage memory ExtMEM, for example a “flash” memory.

[0040] An access rights management means is configured to allocate access rights to the different memory regions RI, R2, and can typically be embodied by a secure context of the CPU processor.

[0041] Optionally, the access rights management means can be embodied by a COPROC security coprocessor dedicated to the management of access rights and the authentication of contents loaded into MEM memory. The COPROC security coprocessor is particularly advantageous in the case where the SOC system on chip comprises several master devices capable of accessing the memory, in particular in the case of a multiprocessor system on chip, comprising several CPU processors.

[0042] For example, the access rights may conventionally include a read permission status "rd" ([Fig.4]) and a write permission status "wr" ( [Fig.4]) for each memory region RI, R2, and for each master device CPU capable of generating a request for access to the memory MEM.

[0043] Furthermore, the CPU access rights management means, COPROC is configured to assign an execution permission status “exe” ([Fig.4]), which can be either “executable” E or “non-executable” NE, for each memory region RI, R2 in the firewall device FWL, and for each master device CPU capable of generating a request for access to the memory MEM.

[0044] Memory regions having the non-executable NE execution permission status may independently have the read-permitted or read-unpermitted status as well as the write-permitted wr or write-unpermitted wr status.

[0045] In particular, in steps 100 and 300 described below, the implementations of the verifications of the authenticity of the program code must advantageously be able to access the corresponding memory regions in read mode.

[0046] The non-executable NE status thus makes it possible to authorize the reading of memory regions, without opening up a risk of illicit execution of the content of these memory regions.

[0047] The FWL firewall device and the CPU processor are configured such that the contents of a memory region having an executable status E are capable of being executed by the CPU processor, and the contents of a memory region having a non-executable status NE cannot be executed by the CPU processor.

[0048] Indeed, the memory access requests communicated on the bus BUS may include information representing the fact that the content of the memory region RI, R2 accessed is intended to be executed by the processor CPU. This is particularly the case for integrated system buses of the “AXI” type.

[0049] For example, the execution information can be communicated in the form of a dedicated bit in the header data of the request (usually "header" in English), the request also comprising other information such as the address of the memory region to be accessed.

[0050] Thus, an access request for execution to a memory region R2 having the non-executable status NE in the FWL firewall will be blocked by the FWL firewall and will not result in transmission of the contents of this memory region R2 to the master device CPU having issued the request.

[0051] Figures 1 to 3 illustrate steps 100, 200, 300 of an example of application of the protection mechanism obtained by the execution permission status E, NE of the contents of the memory regions RI, R2 in the firewall FWL, within the framework of an initial start-up (usually "boot" in English) of the system on chip SOC.

[0052] [Fig.l] illustrates in this regard a step 100 of the system-on-chip SOC startup process, at the beginning of which the elementary startup code ROMcode is executed.

[0053] The elementary startup code ROMcode controls, for example, a loading of a binary FSBL firmware and an extension of this binary PLGIN firmware from the external mass storage memory ExtMEM, to a first region RI and a second region R2 of the RAM MEM, respectively. In addition, DAT data can be loaded into a third memory region R3 of the RAM MEM, for example also coming from the external mass storage memory ExtMEM.

[0054] In this example, the FSBL firmware may include first stage bootloader instructions and, before its execution, the FSBL firmware is authenticated by the ROMcode elementary boot procedure.

[0055] The elementary ROMcode startup procedure provides in this regard a phase for verifying the authenticity of the content of the memory regions RI, R2 containing FSBL, PLGIN program code. The authenticity verification phase is implemented by the CPU access right management means, COPROC.

[0056] For example, the authenticity verification can be done with a hashing mechanism of the binary code loaded in the memory regions RI, R2, and an identification of a signature with a known key contained in the elementary code ROMcode.

[0057] The FSBL firmware can be authenticated, i.e. validated by the authenticity verification phase, and the "executable" status E of execution permission is assigned to the first memory region RI in the FWL firewall and in the memory management and protection unit MMU / MPU, by the CPU access rights management means, COPROC.

[0058] The PLGIN extension can however come from a third party, and consequently be signed by a specific key unknown to the elementary ROMcode boot code.

[0059] As a result, the PLGIN extension is not authenticated in the verification phase of the elementary code ROMcode, and the "non-executable" status NE of execution permission is assigned to the second memory region R2, in the firewall FWL and in the memory management and protection unit MMU / MPU, by the CPU access rights management means, COPROC.

[0060] Finally, the non-executable status NE is advantageously automatically assigned to the memory regions containing DAT data, i.e. in this example to the third memory region R3.

[0061] Thus, the execution permission statuses E, NE have been set up for the contents FSBL, PLGIN, DAT loaded in the regions RI, R2, R3 of the memory MEM.

[0062] We now refer to [Fig.2].

[0063] [Fig.2] illustrates the SOC system on chip described in relation to [Fig.l], in a second step 200 of the SOC system on chip boot process, during which the FSBL firmware loaded into the MEM memory will be executed by the CPU processor.

[0064] The second step 200 typically comprises a "hot" reset RBT of the CPU processor (usually called "warm reboot" in English) in order to place the CPU processor in a virgin state to execute the FSBL firmware.

[0065] As a result, the protections set in the memory management and protection unit MMU / MPU are also reset to a blank state by the RBT reset of the CPU processor.

[0066] In the classical case, i.e. in the absence of execution permission statuses in the FWL firewall, there is a window of vulnerability before the memory management and protection unit MMU / MPU is re-parameterized, during which a memory region R2, R3 that has not been authenticated or contains data could be illegitimately executed.

[0067] However, the FWL firewall dedicated to memory was not impacted by the RBT reset of the CPU processor and the MMU / CPU memory management and protection unit, and its protection remains active in this vulnerability window. Thus, neither the unauthenticated PLGIN program code of the second region R2, nor the DAT data of the third region R3 can be executed.

[0068] The FSBL firmware can therefore be executed without risk.

[0069] We now refer to [Fig.3].

[0070] [Fig. 3] illustrates the SOC system on chip described in relation to FIGS. 1 and 2, in a third step 300 of the SOC system on chip boot process, during which the FSBL firmware loaded into the MEM memory is executed by the CPU processor.

[0071] On the one hand, the execution of the FSBL microprogram advantageously comprises the resetting of the parameterization of the MMU / MPU memory management and protection unit, such as in step 100.

[0072] On the other hand, the execution of the FSBL microprogram may be able to authenticate the program code of the PLGIN extension, with a second phase of authenticity verification, analogous to the first verification phase described in relation to [Fig.l], but with knowledge of the specific key coming from the third party owners of the PLGIN extension.

[0073] Thus, the PLGIN extension can be authenticated, i.e. validated by the second phase of authenticity verification, and the execution permission status of the second memory region R2 is updated "NEE" to executable status E in the FWL firewall and in the memory management and protection unit MMU / MPU, by the CPU access rights management means, COPROC.

[0074] The authenticity verification phases implemented in steps 100 and 300 may result in invalidation of the contents loaded into the memory MEM, for example due to accidental or spurious corruption of the loaded data. If the contents of a memory region containing program code RI, R2 are not authenticated, then the non-executable status NE is assigned to this memory region RI, R2.

[0075] Steps 100, 200 and 300 have been described in an application of the system-on-chip SOC boot procedure, however, the solution described in steps 100, 200 and 300 can be applied to any other program loading, including for example and in particular a "warm reset" RBT of the CPU processor.

[0076] [Fig.4] illustrates an example of information contained in the FWL firewall to assign access rights for reading rd, writing wr, and exe execution.

[0077] A thirty-two (32) bit register is for example provided for each memory region RI, R2, R3 of the memory MEM. For example, a memory region can be a memory page, that is to say a unit of the physical or functional segmentation of the memory; possibly, a region having a start address and a size defined dynamically according to the stored content.

[0078] In this example, the register of each memory region is capable of containing the particular access rights of eight (8) different master devices, i.e. the read rd, write wr and execute exe permission statuses of each of the eight (8) masters.

[0079] For example, the eight (8) bits b0 to b7 of the register are dedicated to the read permission statuses rd of the eight (8) respective masters; the eight (8) bits b16 to b23 of the register are dedicated to the write permission statuses wr of the eight (8) respective masters; and the eight (8) bits b8 to b15 of the register are dedicated to the execution permission statuses exe of the eight (8) respective masters. The eight (8) bits b24 to b31 of the register can be reserved for another application.

[0080] Thus, the embodiments and implementations described in relation to figures 1 to 4, in which a new status is added in the FWL firewall of the RAM MEM to define the permission to execute the content of the different memory regions, provide additional protection, relating to the execution of the content of the memory regions, and which is linked to the content of the memory and not to the state of the processor.

[0081] This additional protection helps prevent illegal execution of the content. memory, particularly in the event of a fault injection attack and generation of a “glitch” on the program counter.

[0082] It is indeed not possible in the embodiments and implementations described above to execute data or code contained outside the authenticated regions, and software countermeasures can be executed within the framework of the authenticated code.

[0083] Furthermore, the embodiments and implementations described above have the advantages of not being dependent on the architecture of the CPU processor; of being compatible with current configurations of software components, notably and in particular with open source firmware (usually "Open Source" in English); to be compatible in a multiprocessor system, in particular when authentication is delegated to the COPROC security coprocessor; to be compatible with RBT hot resets of the CPU processor and the MMU / MPU memory management and protection unit; and to be based on the FWL memory firewall hardware device and can thus be integrated into a security infrastructure.

Claims

Claims

1. Method for managing access rights of memory regions (RI, R2) of a memory (MEM) comprising an allocation of an execution permission status (E, NE) for each memory region in a firewall device (FWL) dedicated to the memory, such that the content of a memory region having an executable status (E) is capable of being executed by a processor (CPU), and that the content of a memory region having a non-executable status (NE) cannot be executed by the processor (CPU).

2. The method of claim 1, wherein assigning the execution permission status (E, NE) comprises assigning the non-executable status (NE) to the memory regions (R3) containing data (DAT).

3. Method according to one of claims 1 or 2, in which the allocation of the execution permission status (E, NE) comprises a phase of verifying the authenticity of the content of the memory regions (RI, R2) containing program code (FSBL, PLGIN), an allocation of the executable status (E) to the memory regions whose content is authenticated (FSBL) in the verification phase, and an allocation of the non-executable status (NE) to the memory regions (R2) whose content is not authenticated (PLGIN) in the verification phase.

4. Method according to claim 3, in which an execution by the processor (CPU) of the content of a first memory region (FSBL) comprises a second phase of verifying the authenticity of the content of a second memory region (R2), the method comprising an allocation of the executable status (E) to the second memory region (R2) if the content of the second memory region (PLGIN) is authenticated in the second verification phase, and an allocation of the non-executable status (NE) to the second memory region (R2) if the content of the second memory region (PLGIN) is not authenticated in the second verification phase.

5. Method according to one of the preceding claims, wherein the execution permission status (exe) is assigned to each memory region in the firewall device in addition to a read permission status (rd) and a write permission status (wr).

6. The method of claim 5, wherein the memory regions having the non-executable status of execute permission (exe) may have the status read-only (rd) or read-only (rd) as well as the status write-only (wr) or write-only (wr).

7. Method according to one of the preceding claims, wherein said allocation of an execution permission status (E, NE) comprises, for each memory region, an allocation of different respective execution permission statuses (E, NE) to different processors (CPU, COPROC), in the firewall device (FWL).

8. A system-on-chip comprising a processor (CPU), a memory (MEM) having memory regions (RI, R2), and a firewall device (FWL) dedicated to the memory, wherein an access rights management means (CPU, COPROC) is configured to assign an execution permission status (E, NE) for each memory region in the firewall device (FWL), the firewall device and the processor being configured such that the contents of a memory region having an executable status (E) are capable of being executed by the processor (CPU), and the contents of a memory region having a non-executable status (NE) cannot be executed by the processor (CPU).

9. System on chip according to claim 8, wherein the access rights management means (CPU, COPROC) is configured to assign the non-executable status (NE) to memory regions (R3) containing data (DAT).

10. System on chip according to one of claims 8 or 9, in which the access rights management means (CPU, COPROC) is configured to verify the authenticity of the content of memory regions (RI, R2) containing program code (FSBL, PLGIN), to assign the executable status (E) to memory regions whose content is authenticated (FSBL) and to assign the non-executable status (NE) to memory regions whose content is not authenticated (PLGIN).

11. System on chip according to claim 10, wherein the access rights management means (CPU, COPROC), during an execution of the content of a first memory region (FSBL) by the processor (CPU), is configured to secondly verify the authenticity of the content of a second memory region (R2), and to assign the executable status (E) to the second memory region (R2) if the content of the second memory region is secondly authenticated (PLGIN), and to assign the non-executable status (NE) to the second memory region (R2) if the content of the second memory region is not secondly authenticated (PLGIN).

12. A system-on-chip according to one of claims 8 to 11, wherein the access rights management means (CPU, COPROC) is configured to assign the execution permission status (exe) to each memory region in the firewall device in addition to a read permission status (rd) and a write permission status (wr).

13. System on chip according to claim 12, wherein the access rights management means (CPU, COPROC) is configured to assign the read-permitted (rd) or read-not-permitted (rd) status as well as the write-permitted (wr) or write-not-permitted (wr) status, to the memory regions having the non-executable execution permission (exe) status.

14. System on chip according to one of claims 8 to 13, further comprising at least one further processor (COPROC), wherein the access rights management means (CPU, COPROC) is configured to assign, for each memory region, different execution permission statuses (E, NE) respective to the different processors (CPU, COPROC), in the firewall device (FWL).

Images